[IPV6]: inet_sk(sk)->cork.opt leak

IPv6 UDP sockets wth IPv4 mapped address use udp_sendmsg to send the data
actually. In this case ip_flush_pending_frames should be called instead
of ip6_flush_pending_frames.

Signed-off-by: Denis V. Lunev <den@openvz.org>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>

diff --git a/include/net/udp.h b/include/net/udp.h
index 3e55a99..ccce837 100644 (file)
--- a/include/net/udp.h
+++ b/include/net/udp.h
@@ -135,6 +135,7 @@ extern void udp_err(struct sk_buff *, u32);
 
 extern int     udp_sendmsg(struct kiocb *iocb, struct sock *sk,
                            struct msghdr *msg, size_t len);
+extern void    udp_flush_pending_frames(struct sock *sk);
 
 extern int     udp_rcv(struct sk_buff *skb);
 extern int     udp_ioctl(struct sock *sk, int cmd, unsigned long arg);

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index db1cb7c..56fcda3 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -420,7 +420,7 @@ void udp_err(struct sk_buff *skb, u32 info)
 /*
  * Throw away all pending data and cancel the corking. Socket is locked.
  */
-static void udp_flush_pending_frames(struct sock *sk)
+void udp_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
 
@@ -430,6 +430,7 @@ static void udp_flush_pending_frames(struct sock *sk)
                ip_flush_pending_frames(sk);
        }
 }
+EXPORT_SYMBOL(udp_flush_pending_frames);
 
 /**
  *     udp4_hwcsum_outgoing  -  handle outgoing HW checksumming

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1b35c47..dd30962 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 {
        struct udp_sock *up = udp_sk(sk);
 
-       if (up->pending) {
+       if (up->pending == AF_INET)
+               udp_flush_pending_frames(sk);
+       else if (up->pending) {
                up->len = 0;
                up->pending = 0;
                ip6_flush_pending_frames(sk);